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Abstract. An attack on the "Bennett-Brassard 84"(BB84) quantum key-exchange protocol in which Eve 
exploits the action of gravitation to infer information about the quantum-mechanical state of the qubit 
exchanged between Alice and Bob, is described. It is demonstrated that the known laws of physics do not 
allow to describe the attack. Without making assumptions that are not based on broad consensus, the laws 
of quantum gravity, unknown up to now, would be needed even for an approximate treatment. Therefore, 
it is currently not possible to predict with any confidence if information gained in this attack will allow to 
break BB84. Contrary to previous belief, a proof of the perfect security of BB84 cannot be based on the 
assumption that the known laws of physics are strictly correct, yet. 

A speculative parameterization that characterizes the time-evolution operator of quantum gravity for 
the gravitational attack is presented. It allows to evaluate the results of gravitational attacks on BB84 
quantitatively. It is proposed to perform state-of-the-art gravitational attacks, both for a complete security 
assurance of BB84 and as an unconventional search for experimental effects of quantum gravity. 



PACS. 03.67.Dd Quantum cryptography 
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1 Introduction 

Quantum key-distribution (QKD) protocols, often collec- 
tively called "quantum cryptography" , exploit the prin- 
ciples of quantum mechanics to enable the secure distri- 
bution of information It is a common belief that the 
perfect secrecy of keys exchanged by such protocols is 
guaranteed if the "known laws of physics" 1 are assumed 
to be strictly correct This would be a major advan- 
tage of quantum cryptography because an analogous se- 
curity guarantee for classical cryptography - based on the 
correctness of proven, or at least highly plausible, mathe- 
matical theorems 2 - is not possible, yet|3|. 
Section [21 presents a novel attack procedure against the 
first and best known QKD protocol, the "Bennett-Brassard 
84" (BB84) protocol^], in which the attacker exploits the 
action of gravity. I demonstrate in section [3] that this at- 
tack cannot be modelled - not even to any approximation 
- on the basis of the known laws of physics without mak- 
ing assumptions that are not based on broad consensus. 
Even though its security proof is shown to be incomplete, 
BB84 retains its great value because it rests on completely 
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1 Defined here as an expression that was derived from a con- 
sistent mathematical framework (a "theory of physics") and 
has been confirmed by repeated scientific experiments. 

2 The analogues to laws of physics. 



different foundations than its classical counterparts. How- 
ever, for a complete security assurance one needs to at- 
tack the protocol experimentally. In sectional propose a 
framework in which the results of gravitational attacks on 
BB84 can be evaluated quantitatively. In this framework 
Eve breaks BB84 via gravitationally cloning a qubit, sec- 
tion [S] studies if this indirectly violates special relativity. 
Section concludes . 



2 The "gravitational-attack" protocol 

In the BB84 protocol the honest party ("Alice") encodes 
a bit of the key to be distributed by preparing a qubit "Q" 
either in one of the four quantum- mechanical states \W > 

= |o >, |# > = |i >, \v >=|+> = ^(|o > + |i >) 

or \W > = |- > = ^j(|0 > - |1 >)■ She then sends Q 

to its designated receiver ( "Bob" ) . Rigorous proofs of the 
security of BB84 5jE| are based on the assumption that 
the laws of quantum physics are correct. However, these 
proofs ignore gravitation. Implicitly they assume that at- 
tackers only employ the resources of quantum physics in 
flat space time. However, it seems overly optimistic to 
"require" eavesdroppers to avoid the profound difficul- 
ties that still beset any attempt to definitely answer the 
question: "What gravitational field corresponds to a given 
quantum state?" 
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In a "gravitational attack" the eavesdropper (malicious 
"Eve") employs a beam splitter to evolve Q into a state: 

\&>=l/y/2(\9(xi)>+\V(x 2 )>) (1) 

consisting of two spatially separated components at the 
spatial positions xi and X2, respectively. She then mea- 
sures the state of > in one of the bases employed in 
the BB84 protocol (|0 >, |1 >) and the state of \&(x 2 ) > 
in the other base (|+ >, |— >)■ Depending on which of 
the four possible measurement results \s > (with s=0, 
s=l, s=+ or B=-) is obtained, a macroscopic test mass 
M, initially at the spatial position x(l), is automatically 
moved to (or left at) one of four separated spatial posi- 
tions x(0),x(l),x(+),x(~). Immediately thereafter Eve ex- 
perimentally determines the gravitational field surround- 
ing these four positions, e.g. with the help of a Cavendish 
setup. Can we derive a definite prediction for the results 
of Eve's field-strength determination, based on the known 
laws of physics? 

3 The attack cannot be described by the 
known laws of physics - not even 
approximately 

The only "known law of physics" that describe gravitation 
are classical: they derive from Einstein's theory of gen- 
eral relativity [7|. The only theoretical ansatz to describe 
the attack that keeps both general relativity and quantum 
physics unchanged is "semiclassical gravity". It proposes 
that the source of the gravitational field is the quantum 
expectation value of the energy tensor of matter [H]: 

G M „ = 8^G/c 2 < M\T^\M > (2) 

here is the classical Einstein tensor, G is Newton's 
constant of gravitation, c the speed of light, T Miy the stress- 
energy tensor and \M > the quantum mechanical state 
of the gravitating body. However, this expression cannot 
be considered to be even an established approximation 
to a law of nature. If there is no wave-function collapse 
and standard quantum physics allows a complete descrip- 
tion of nature, i.e. if the "many-worlds" interpretation 
(MWI) of quantum mechanics [TTjUTT] is correct, eq. (J2J) pre- 
dicts a nonlinear coupling of quantum-mechanical state 
components jS] (see section FTTI for further explanation). 
Page and Geilker[§| presented experimental data that rule 
out such a coupling at the strength expected from eq.10 
with a high confidence level. The nonlinear coupling does 
not vanish in the low-energy or weak-field limit of eq. (JSJ ■ 
Within the MWI eq.© is wrong even to the approxima- 
tion that general relativity describes gravitation. Page and 
Geilker drew the conclusion that there must be as yet un- 
known laws of physics, beyond semiclassical general rela- 
tivity, that describes their experiment. 
The quantum-information community is currently not in 
a state of agreement whether the MWI is correct, but 
some of its eminent members advocated this idea |12U13l 



114) . and many specialists at least admit the principal pos- 
sibility that it might be correct [To] . The assumption that 
this interpretation is wrong clearly would be not based 
on a broad consensus and can therefore serve neither as a 
basis for a prediction of the outcome of the attack nor for 
any sound security proof. 

More complicated schemes to couple a classical gravita- 
tional field to the quantized matter field might be possi- 
ble, but have not been proposed, yet, to my knowledge. 
It is generally considered much more likely that general 
relativity will turn out to be the limit of Ti — > of a 
theory of "quantum gravity" , that remains to be discov- 
ered. However, due to various technical and conceptual 
difficulties, all candidate theories of quantum gravity[S] 
still fall far short of a reliable basis for deriving "known 
law of physics" . Moreover none of the nonperturbative ap- 
proaches to this problem have obtained a definite classical 
limit, yet. Thus, even if one of them were a correct theory 
of physics, it would not be possible to derive predictions 
for the attack, yet. In particular there is no basis on which 
certain properties of the known laws of quantum mechan- 
ics, like e.g. its linearity, can be assumed to hold for quan- 
tum gravity. 

Summarizing, in the possible case that the "many-worlds 
interpretation" is correct, even for a qualitative prediction 
of the result of Eve's measurement a theory of quantum 
gravity is needed. All proofs of the security of BB84 re- 
main incomplete because a definite theoretical basis to 
address the question "What information can Eve extract 
from the exchanged qubit in a "gravitational attack"?" 
does not exist presently. With other words: our failure to 
understand quantum gravity prevents a basic condition 
for any security assurance to be met for QKD, yet: the 
target of evaluation must be thoroughly understood, also 
when being under attack. 

4 An "insecure-BB84" scenario: nonlinear 
quantum gravity 

To illustrate how laws of quantum gravity could render 
BB84 brittle, to motivate experimental attacks on this 
protocol, and to supply a framework for their analysis, I 
characterize a speculative time-evolution operator of quan- 
tum gravity for the gravitational attack in section 14.31 
This is not meant as a serious proposal for a theory of 
quantum gravity, but merely as parameterization to allow 
a quantitative analysis of "gravitational attacks" . Non- 
linearity was chosen only as an example. There might be 
other characteristics of quantum gravity that render QKD 
vulnerable. 

Section l4~D reviews semiclassical gravity, already discussed 
in section |3J more formally. Under the assumptions dis- 
cussed in sectional this theory predicts a strongly nonlin- 
ear evolution during and after the "gravitational attack" . 
As the opposite extreme section l4~2*l presents a completely 
linear form of the time-evolution operator of quantum 
gravity. In section l4~3l I propose a "general" time-evolution 
operator that interpolates between these two cases. 
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For illustration let us always assume below that initially 
Alice prepares the exchanged qubit in the BB84 protocol 
in the state W >=U >• 



4.1 Semiclassical gravity 

Let us first assume that the gravitational field remains a 
classical field even at the fundamental level, i.e. that eq.J2J) 
is a law of physics. As in section [3] we assume the MWI. 
The initial "state" 3 of the system of qubit Q and test mass 
M is given as: 

^semiclassical gravity > (t = 0) >= |1 > ®|M(1) > G>„(l) 

(3) 

Here and in the following \s > denotes the state of a qubit 
exchanged in BB84, and \M(s) > the one of the macro- 
scopic test mass. G M „(s) is the classical Einstein tensor, 
that characterizes the structure of space time with an iso- 
lated macroscopic test mass M(s) at the spatial position 
x(s) . s denotes the state of the exchanged qubit Q accord- 
ing to the attack protocol (see section |2J) . According to 
eq.10): 



G M „(s) = SnG/c 2 < M(s)\T^\M(s) > 



(4) 



The exchanged qubit is neglected in this expression be- 
cause of its usually very small mass energy. The quantum- 
mechanical state after the gravitational attack (section |2J 
is given as: 

\<f>QM>(t = tf) = -^=\l>®\M(l)> + 

1/2(|+ > ®|Af(+) > +|- > <8>|Af(-) >) (5) 
Including the gravitational field one obtains: 

| ^semiclassical gravity > (* = */) = Kg|0 > (t = 0) = 

-L|1>®|M(1)> + 

1/2(1+ > ®|M(+) > +|- > <8|M(-) >)G^{4> QM ) (6) 

The classical Einstein tensor G^ v {4>qm) characterizes the 
gravitational field exerted by all three mass components 
M(1),M(+) and M(— ). It can be evaluated by inserting 
eq.((5jl into eq.(J5J. Because cross terms rapidly vanish due 
to decoherence, the source of this gravitational-field are 
the expectation values of the energy tensor of the three 
masses and one obtains: 



G 



fit/ 



) = 1/2G M „(1) + 1/4G^(+) + 1/4G^(-) (7) 



The further evolution of this state is strongly nonlinear 
due to the gravitational coupling, i.e. V sg cannot be a 
linear operator, but must be some different nonlinear op- 
erator of quantum gravity. 

3 This is not a quantum mechanical state in the usual sense 
but a juxtaposition of quantum-mechanical and classical fields. 



4.2 Linear quantum gravity 

Alternatively the hypothetical gravitational quantum field 
could obey an equation of motion, that is precisely linear 
- like all other known quantum fields do. The initial state 
of the setup before the attack is then written as: 

|0>(t = O) = |l>®|M(l)>(g)|G, H ,(l)> (8) 

|Gp„(s) > symbolizes a hypothetical "quantum state of 
the gravitational field" that is characterized by a space- 
time structure described by the classical Einstein tensor 
Gfj, v (s) (eq.(@J) that describes space time for an isolated 
test mass M(s) at spatial position x(s). 
Uiqg be a linear unitary operator. The final state at time 
tf after the attack described in sectionals then given as: 

I ^linear quantum gravity ^ \Pf) ^lqgl^ \t — 0) — 

-=\1 > ®|M(1) > ®|G M „(1) > + 
v2 

1/2(|+ > <g>|M(+) > ®\G„ U (+) > + 

|- > ®|Af(-) > ®|G^(-) >) (9) 

The further evolution of this state will be linear. 



4.3 General quantum gravity 

If the MWI interpretation is correct, it is experimentally 
excluded that eq.JHJ), that is initially relatively well moti- 
vated theoretically 4 , is correct (section |2Jl . On the other 
hand, the assumption of strictly linear U; gg in eq.@, that 
is in agreement with all available data, lacks any theo- 
retical basis. It has indeed been recently speculated that 
quantum gravity is nonlinear jlfij. 

Nonlinear effects might not be negligible even if they occur 
only near the Planck energy scale Mpi anc k. Phenomeno- 
logical effects at familiar energies would are typically sup- 
pressed by a factor s=(m p /Mpi anc k) 2 , where m p is the pro- 
ton mass. Recently string theories with large extra dimen- 
sions, in which the Planck scale Mpi anc k might be as small 
as 1 TeV, have been developed^!!- The suppression fac- 
tor s might thus be of respectable magnitude for energies 
commonly encountered in the laboratory. 
Clearly a plausible general phenomenological ansatz for 
time evolution in quantum gravity must allow for the pos- 
sibility of nonlinearity. Let us assume the initial state of 
eq.(JBJ). As the final state I propose a combination of of the 
linear eq.@ and the semiclassical eq.©: 

(^general quantum gravity (^ tf ) 

V gqg |0>(t = O) = 
-i=|l>®|M(l)>®|G™ 1 (l)> + 



1/2(|+ > ®|Af(+) > ®|GfJ lcral (- 



> 



|- > ®|M(-) > ®|Gp eral (-) >) 



(10) 



Since it only combines "known laws of physics" . 
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with the classical Einstein tensor: 



G s ;r a V) = GW(*) + be- XAt G^QM) (11) 



G tlv {s) is given by eq.|@} and G^^qm) by eq.J7J). b and 
A are both purely phenomenological constants, b < 1 is 
the amplitude of a "nonlinear component" and 1/A a time 
scale on which the nonlinear component of the gravita- 
tional field is assumed to decay spontaneously after it first 
appears due to some mass movement. Z\t=t-t/ is the time 
since moving the masses to their respective spatial posi- 
tions, i.e. after the end of the attack. The evolution of this 
state is nonlinear due to a gravitational coupling with an 
amplitude b e~ XAt , i.e. V gqg can be a linear operator only 
to some approximation. 

The gravitational field described by the second term in 
eq. Ijlll) is determined by all three components of the test- 
mass state even after Eve measured Q. From eq.(0) one 
reads that the component with the largest tensor ampli- 
tude in the second term (in our example |1 >) corresponds 
to the state in which Alice prepared the qubit. Via exper- 
imentally determining the exact structure of the second 
term, Eve can thus infer the state of the exchanged qubit. 
She is then able to construct a clone of the exchanged 
qubit and sends it to Bob. BB84 is now broken, because 
Eve disposes of the same resources as Bob who cannot 
detect her eavesdropping. In the scenario Eve's attack ex- 
ploits an EmSec vulnerability: Q can be cloned due to the 
uncontrolled emission of static gravitational fields. 
I constructed the framework of section HTSl wcaring the hat 
of a security specialist, not the one of a research scientist. 
The latter would tend to make assumptions that allow a 
consistent understanding of the attack: either the stan- 
dard interpretation of quantum mechanics or a quantum 
theory of gravity that is strictly linear. The former tries 
to endanger the security of BB84 with ideas that are rea- 
sonably plausible and are clearly not in conflict with the 
known laws of physics: the "many-worlds interpretation" 
of quantum mechanics and nonlinear quantum gravity. 
I propose to perform the attack described in section as 
sensitive and on a time scale as short as possible with 
state-of-the-art equipment. The results of such an exper- 
iment can be used to set an upper limit on b and A in 
ea. ljl"U|) . respectively. 

For A=0 the experimental results of Page and Geilker[Hj 
limit b to be smaller than about 0.1. However, an attacker 
who exploits state-of-the-art methods could explore mag- 
nitudes of b several orders of magnitude smaller. 
Sensitive limits on b and A would be an empirical assur- 
ance that BB84 is secure against gravitational attacks. 
Our trust in BB84 could then be analogous to the one con- 
ferred to classical cryptographic procedures by dedicated 
but unsuccessful attempts of highly qualified personnel to 
break them. In both cases there is no guarantee that an 
attacker might not find some creative, unexpected way to 
break the protocol. 



5 A successful attack does not need to 
violate special relativity 

The illustrative successful attack option described in sec- 
tion l4.3l involved the cloning of a quantum state. The "no- 
cloning" theorem forbids this, but its prooffl] assumes the 
linearity of temporal evolution that is guaranteed by the 
laws of conventional quantum mechanics but might not 
hold in quantum gravity. 

More generally it was argued that any successful cloning 
of quantum states would necessarily enable superlumi- 
nal signalling 18 . If that were true, a successful attack 
would appear to be ruled out under the usually stated 
assumptions for quantum cryptography, because superlu- 
minal signalling contradicts the "no-signalling theorem" a 
known law of physics that can be derived from special rel- 
ativity. However, Kent 19 has recently argued that a pro- 
cedure that allows the cloning of pure, localized states, but 
not the cloning of subsystems of "non-local" mixed states, 
avoids the argument above. Moreover Polchinski|2Dl has 
shown that if the MWI is correct, universal cloning leads 
to the possibility of communication between macroscopic 
components of the total wavefunction, rather than super- 
luminal signalling. Such an "Everett phone" would nei- 
ther be in obvious contradiction with any known law of 
physics nor would it lead to counterintuitive effects if the 
time scale 1/A in ea. l|ll|l is sufficiently short. 



6 Summary and outlook 

It is well known that the security of quantum cryptog- 
raphy could be compromised if the laws of quantum me- 
chanics are not strictly correct 5 , e.g. if the usual quantum- 
mechanical operator "U" , describing temporal evolution, 
would contain a small nonlinear term. However, the as- 
sumption of its strict linearity is a law of physics that 

a. derives from quantum mechanics (a mathematically con- 
sistent theory of physics) and 

b. has been verified experimentally to great precision |52j. 
Therefore, the security of quantum cryptography was thought 
to rest on very solid foundations. 

Here I proposed a practical attack procedure that cannot 
be described without a theory of quantum gravity even 
approximately in general. It breaks BB84 if gravitational 
nonlinearities exist. However, neither 

a. do we know a consistent theory of quantum gravity 
nor 

b. was the linearity of evolution in the presence of grav- 
itational fields checked with the precision that can be 
achieved with state-of-the-art equipment. 

Therefore presently the security of quantum cryptography 
against this attack can be guaranteed neither by recourse 
to general principles nor by evaluating results of sensitive 
experimental tests. 

5 This realization has led to recent proposals for QKD pro- 
tocols that are claimed to remain secure even if the laws of 
quantum mechanics are not strictly correct |2T]. 
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The latter gap could be quickly closed: experimental at- 
tacks on BB84 could assure at least the practical (if not 
theoretical) security of this protocol. Such a test receives 
additional justification as an unconventional search for ex- 
perimental clues to quantum gravity. 
A complete theoretical treatment of the fundamental secu- 
rity of quantum cryptography will only be possible when 
the correct theory of quantum gravity is found. This raises 
a considerable practical interest in the most fundamen- 
tal subject of contemporary physics. If the security of 
quantum cryptography can be proved in the absence of 
a full theory of quantum gravity, perhaps for other pro- 
tocols than BB84, is an important question for further 
research P^]. 
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